Analysis
-
max time kernel
20s -
max time network
17s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
29/08/2024, 11:39
Static task
static1
Behavioral task
behavioral1
Sample
temp.sys
Resource
win10-20240404-en
windows10-1703-x64
6 signatures
150 seconds
General
-
Target
temp.sys
-
Size
13KB
-
MD5
aff9874bcc79ffe905a385c8cf359e15
-
SHA1
4b1f52d0152900c9647b40dc067a143f9faca2e2
-
SHA256
a597c95c65007406acf68f93b831c69ff95ec98a4fadadf88618b21d01c0611b
-
SHA512
cf6fbc0c9e16c4cc1d8ad6c45e1c573b64d495af722704f1bc8e4ddaef3c7cb4320d4a8f2a992ff47210190e6356fbcae926f3f1e7d5f88056ccea03b6f28e96
-
SSDEEP
192:s2PHeCIM8T4ZaVynlkRJ2N3hquLa5uDm3B7lAr1i8nr9ZCspE+TMDQrjt2:s+eunlkRJ2NxlTm3BKEeMDz
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2468 taskmgr.exe Token: SeSystemProfilePrivilege 2468 taskmgr.exe Token: SeCreateGlobalPrivilege 2468 taskmgr.exe Token: 33 2468 taskmgr.exe Token: SeIncBasePriorityPrivilege 2468 taskmgr.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe 2468 taskmgr.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\temp.sys1⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\temp.sysC:\Users\Admin\AppData\Local\Temp\temp.sys2⤵PID:344
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2468